Check an IP Address, Domain Name, Subnet, or ASN
212.113.98.30 has a threat confidence score of 100%. This IP address from Russia (AS206134, Nekobyte International Limited) has been observed in 5,385 honeypot sessions and reported 96 times targeting POSTGRES, DOCKER protocols. Detected attack patterns include postgres rce with superuser persistence and capability suppression, postgres copy from program rce with superuser persistence, docker remote api container creation sequence. First observed on January 21, 2026, most recently active April 21, 2026.
Represents an advanced PostgreSQL compromise chain where an attacker achieves OS command execution via COPY ... FROM PROGRAM, establishes persistent administrative access by creating a new superuser role, and then deliberately revokes the pg_execute_server_program privilege from the default postgres role.
Represents a full PostgreSQL host compromise chain in which an attacker fingerprints the database server, prepares a temporary table to capture command output, executes arbitrary OS commands via COPY ... FROM PROGRAM (commonly using base64-encoded shell payloads), and subsequently establishes persistence by creating a new PostgreSQL role with LOGIN and SUPERUSER privileges. This behavior indicates successful remote command execution on the database host followed by deliberate persistence inside PostgreSQL, allowing the attacker to retain long-term administrative access even if the initial access vector is closed.
Identifies a coordinated interaction with the Docker Remote API where an actor issues HTTP GET and POST requests culminating in container creation. This pattern is consistent with automated abuse of an exposed Docker daemon (typically unauthenticated on TCP/2375), where the attacker probes the API and then programmatically creates a container for code execution or persistence.
| Reporter | Date | Category | Protocol | Comment |
|---|---|---|---|---|
| User | Mar 22, 2026, 06:11 | Brute Force | POSTGRES | SikkerGuard: 2 blocked packets |
| User | Mar 22, 2026, 06:06 | Brute Force | POSTGRES | SikkerGuard: 12 blocked packets |
| User | Mar 22, 2026, 24:17 | Brute Force | POSTGRES | SikkerGuard: 14 blocked packets |
| User | Mar 21, 2026, 18:14 | Brute Force | POSTGRES | SikkerGuard: 14 blocked packets |
| User | Mar 21, 2026, 24:17 | Brute Force | POSTGRES | SikkerGuard: 322 blocked packets |